Being abused by Google Server?

Question

I got a lot of POST requests from google's server to my website. It requests time to time, never stops.

35.196.208.182 - - [18/Nov/2019:04:39:21 -0700] "POST /?wc-ajax=get_variation HTTP/1.1" 200 689 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36"


cat /var/log/nginx/*access.log|grep "35.196.208.182"|awk '{print $1}'|wc -l

4110

Another ip before i blocked it

cat /var/log/nginx/*access.log|grep "34.73.127.196"|awk '{print $1}'|wc -l

11454

Could it be GCP monitoring? have you set that up? – hookenz Nov 18 '19 at 21:06 — hookenz, Nov 18 '19 at 21:06

score 2 · Answer 1 · answered Nov 18 '19 at 15:29

2

That is from someone using Google Cloud Platform hosting, not any Google bot.

Google bots have Google in the user agent, and don't look like browsers.
Google bots resolve in DNS as googlebot.com or google.com. These are from googleusercontent.com.

Open GCP abuse reports with the form for that.

See also over at Super User: What do you do if you are being hacked by something coming from a supposedly legitimate IP address such as from Google?

answered Nov 18 '19 at 15:29

John Mahowald

32,050
2
19
34

I sent google report but I've never heard anything from them. – Kevin Nguyen Nov 30 '19 at 04:50

score 1 · Answer 2 · answered Nov 18 '19 at 19:28

Answering your question is difficult as you have provided very little information. I will explain the steps that I go thru when reviewing traffic and deciding if a source should be blocked. This is the classic What, Who, and When type of analysis.

STEP 1: WHAT

Do you understand what the request is? How often is the request being made to your server? Is this request causing your server or service a problem or are you just annoyed by it?

wc-ajax=get_variation is a request for product variations for WooCommerce. This may or may not be a good request. This could simply be a bot that is indexing products for your website. You will have to decide.

STEP 2: WHO

Did you investigate who the source is? A Reverse DNS Lookup sometimes provides meaningful information. Also, do a curl to that IP address. If there is no website there, probably a bot or bad actor.

An IP address that is owned by Google does not mean that Google is attacking you. Google provides services to other companies/people. Your server is public, expect all kinds of XXX from all kinds of sources.

This IP address 35.196.208.182 resolves to googleusercontent.com. This means a service provided by Google. This could be Google Cloud but not Google itself.

STEP 3: WHEN

What time of the day are these requests arriving? How frequently: once per minute, once per hour, etc.? Well behaved bots will not overload your sites with requests. In your question, you show 11,454 requests. That seems high (as in bad bot), but you do not show the time period for these requests.

Recommendations

Your server is public. You will pull your hair out blocking IP addresses. Hackers and bad bots frequently change their IP addresses or service locations. This means that an IP address that you block today, might be for a real customer tomorrow or next month.

Install an intelligent WAF (firewall) that automatically detects and blocks traffic like this. Set the block duration low as in 24 hours after XX requests have arrived in 5 minutes or 8 hours or whatever you decide.

Thank you for your comment. 1. I blocked them everyday 2. I tried. There is no website located on those IP 3. They requested second to second. — Kevin Nguyen, Nov 30 '19 at 04:57

Being abused by Google Server?

2 Answers2